CVE-2020-0938 in microsoft windows 10 1507
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Adobe Font Manager Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1020.
Affected software: microsoft windows 10 1507, microsoft windows 10 1607, microsoft windows 10 1709, microsoft windows 10 1803, microsoft windows 10 1809, microsoft windows 10 1903, microsoft windows 10 1909, microsoft windows 7, microsoft windows 8.1, microsoft windows rt 8.1
Scores
- CVSS: 7.8 (high)
- EPSS: 68.95% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2021-11-03
- Published: 2020-04-15
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Install the April 2020 Windows security update for the Adobe Font Manager Library (CVE-2020-0938)
Patch or upgrade. Installs Microsoft's April 14, 2020 security update, which fixes how the Adobe Type Manager Library (atmfd.dll) parses multi-master Type 1 PostScript fonts. This removes the code execution risk from opening or previewing a crafted font or document.
Applies to: Windows 7, 8.1 and RT 8.1, Windows 10 (1507 to 1909), and Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019, 1803, 1903 and 1909 without the April 14, 2020 security update. On Windows 10 the font code runs in a sandboxed AppContainer, which limits the impact.
- Find every Windows host that has not installed the April 14, 2020 cumulative or security update or a later one (for example, run 'Get-HotFix | Sort-Object InstalledOn' or check your patch tool or WSUS report).
- Windows 10 and Server 2016/2019: install the latest cumulative update for your build. Each one includes the April 2020 fix (for example KB4549951 for 1903/1909, KB4549949 for 1809/Server 2019, KB4550929 for 1607/Server 2016).
- Windows 8.1 and Server 2012 R2: install the latest monthly rollup (April 2020: KB4550961, or the security-only update KB4550970).
- Windows 7 SP1 and Server 2008 R2: you need an Extended Security Updates (ESU) licence to get this fix (April 2020: KB4550964 monthly rollup or KB4550965 security-only). Plan to replace hosts that have no ESU, because they stay vulnerable.
- Restart the hosts so the patched font driver loads.
- If you cannot patch right away, use Microsoft's workarounds from advisory ADV200006: turn off the Preview Pane and Details Pane in Windows Explorer, stop and disable the WebClient service, and on Windows versions older than Windows 10 rename %windir%\system32\atmfd.dll. Undo these changes after you patch.
- Check that the vulnerability scans no longer report CVE-2020-0938.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.